diff --git a/hosts/server/configuration.nix b/hosts/server/configuration.nix
index c604f61..4db719e 100644
--- a/hosts/server/configuration.nix
+++ b/hosts/server/configuration.nix
@@ -7,6 +7,7 @@
     ./modules/internal/security.nix
     ./modules/internal/openssh.nix
     ./modules/internal/adguard.nix
+    ./modules/internal/cockpit.nix
     # ./modules/internal/unifi.nix # FIXME: unifi5 is deprecated
 
     # exposed
diff --git a/hosts/server/modules/internal/cockpit.nix b/hosts/server/modules/internal/cockpit.nix
new file mode 100644
index 0000000..e27ec94
--- /dev/null
+++ b/hosts/server/modules/internal/cockpit.nix
@@ -0,0 +1,8 @@
+# Web-based graphical interface for servers
+{
+  services.cockpit = {
+    enable = true;
+    port = 3009;
+    openFirewall = true;
+  };
+}